Code clean up

loongson-zjl · Mar 31, 2021 · 0351f19 · 0351f19
1 parent 153af38
commit 0351f19
Show file tree

Hide file tree

Showing 4 changed files with 45 additions and 17 deletions.
diff --git a/configure.ac b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ( 2.59 )
 
 AC_INIT(
  [libpff],
- [20210327],
+ [20210331],
  [[email protected]])
 
 AC_CONFIG_SRCDIR(

diff --git a/libpff/libpff_file_header.c b/libpff/libpff_file_header.c
@@ -145,20 +145,21 @@ int libpff_file_header_read_data(
      size_t data_size,
      libcerror_error_t **error )
 {
-	const uint8_t *file_header_data = NULL;
-	static char *function           = "libpff_file_header_read_data";
-	uint32_t calculated_checksum    = 0;
-	uint32_t stored_checksum        = 0;
-	uint16_t content_type           = 0;
-	uint16_t data_version           = 0;
+	const uint8_t *file_header_data                  = NULL;
+	static char *function                            = "libpff_file_header_read_data";
+	uint64_t safe_descriptors_index_root_node_offset = 0;
+	uint32_t calculated_checksum                     = 0;
+	uint32_t stored_checksum                         = 0;
+	uint16_t content_type                            = 0;
+	uint16_t data_version                            = 0;
 
 #if defined( HAVE_DEBUG_OUTPUT )
-	const uint8_t *value_data       = 0;
-	uint64_t value_64bit            = 0;
-	uint32_t value_32bit            = 0;
-	uint16_t value_16bit            = 0;
-	uint8_t sentinal                = 0;
-	int value_iterator              = 0;
+	const uint8_t *value_data                        = 0;
+	uint64_t value_64bit                             = 0;
+	uint32_t value_32bit                             = 0;
+	uint16_t value_16bit                             = 0;
+	uint8_t sentinal                                 = 0;
+	int value_iterator                               = 0;
 #endif
 
 	if( file_header == NULL )
@@ -459,7 +460,9 @@ int libpff_file_header_read_data(
 
 		byte_stream_copy_to_uint32_little_endian(
 		 ( (pff_file_header_data_32bit_t *) file_header_data )->descriptors_index_root_node_offset,
-		 file_header->descriptors_index_root_node_offset );
+		 safe_descriptors_index_root_node_offset );
+
+		file_header->descriptors_index_root_node_offset = (off64_t) safe_descriptors_index_root_node_offset;
 
 		byte_stream_copy_to_uint32_little_endian(
 		 ( (pff_file_header_data_32bit_t *) file_header_data )->offsets_index_back_pointer,
@@ -487,7 +490,9 @@ int libpff_file_header_read_data(
 
 		byte_stream_copy_to_uint64_little_endian(
 		 ( (pff_file_header_data_64bit_t *) file_header_data )->descriptors_index_root_node_offset,
-		 file_header->descriptors_index_root_node_offset );
+		 safe_descriptors_index_root_node_offset );
+
+		file_header->descriptors_index_root_node_offset = (off64_t) safe_descriptors_index_root_node_offset;
 
 		byte_stream_copy_to_uint64_little_endian(
 		 ( (pff_file_header_data_64bit_t *) file_header_data )->offsets_index_back_pointer,

diff --git a/libpff/libpff_index.c b/libpff/libpff_index.c
@@ -568,7 +568,7 @@ int libpff_index_read_node_entry(
 	uint8_t *node_entry_data        = NULL;
 	static char *function           = "libpff_index_read_node_entry";
 	off64_t element_data_offset     = 0;
-	off64_t sub_nodes_offset        = 0;
+	uint64_t sub_nodes_offset       = 0;
 	int result                      = 0;
 
 	if( index == NULL )
@@ -820,10 +820,21 @@ int libpff_index_read_node_entry(
 		}
 		else if( result == 0 )
 		{
+			if( sub_nodes_offset > (uint64_t) INT64_MAX )
+			{
+				libcerror_error_set(
+				 error,
+				 LIBCERROR_ERROR_DOMAIN_RUNTIME,
+				 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
+				 "%s: invalid sub nodes offset value out of bounds.",
+				 function );
+
+				return( -1 );
+			}
 			if( libfdata_tree_node_set_sub_nodes_data_range(
 			     index_tree_node,
 			     0,
-			     sub_nodes_offset,
+			     (off64_t) sub_nodes_offset,
 			     0,
 			     0,
 			     error ) != 1 )

diff --git a/libpff/libpff_item_tree.c b/libpff/libpff_item_tree.c
@@ -792,6 +792,18 @@ int libpff_item_tree_create_node(
 
 		return( -1 );
 	}
+	if( ( recursion_depth < 0 )
+	 || ( recursion_depth > 256 ) )
+	{
+		libcerror_error_set(
+		 error,
+		 LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
+		 LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,
+		 "%s: invalid recursion depth value out of bounds.",
+		 function );
+
+		return( -1 );
+	}
 	/* Check if the index node can be read
 	 */
 	if( libfdata_tree_node_get_number_of_sub_nodes(